CVE-2020-37284

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...

CVE-2020-37284 Sickbeard build-507 Reflected XSS via testNaming pattern Parameter

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...

EUVD-2020-31287

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...

CVE-2020-37284 Sickbeard build-507 Reflected XSS via testNaming pattern Parameter

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...

CVE-2020-37284

The Sickbeard software, versions through build-507 , is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is the testNaming handler failing to escape the pattern parameter of the /config/postProcessing/testNaming endpoint. Unauthenticated attackers can craft GET r...

VulnCheck KEV: CVE-2020-37284

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...

PT-2026-121341

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...

CVE-2020-37284: Improper Neutralization of Input During Web Page Generation

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...

midgetspy Sickbeard cross-site scripting vulnerability

The midgetspy Sickbeard vulnerability stems from a cross-site scripting flaw. This arises due to improper handling of the “pattern” parameter in /config/postProcessing/testNaming; the testNaming handler fails to escape returned content. As a result, unauthenticated attackers can craft GET request...

Discourse cross-site scripting vulnerability

Versions 1.9.0.beta2 through 1.9.0.beta13 of Discourse contain a cross-site scripting vulnerability. This arises from the lack of validation on the /email/unsubscribed email parameter; the unsubscribed.html.erb file uses htmlsafe without proper escaping. As a result, it may be exploited for...

EUVD-2026-36041

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, wrapline app/modules/common/common.py:181-186 and highlightword app/modules/common/common.py:188-192 build raw HTML by string concatenation with no escaping. The frontend...

CVE-2021-47931 Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication

Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary...

PT-2026-39507

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.6 Description Authenticated attackers can perform stored cross-site scripting by injecting malicious scripts via the Title and Text Block parameters in the text editing endpoint. This is achieved by injecting iframe...

Payload-XSS

Payload-XSS Daftar Isi 1. Payload Dasar 1-20payload-...

Mozilla Thunderbird < 78.3

The version of Thunderbird installed on the remote Windows host is prior to 78.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-44 advisory. - When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a...

Mozilla Thunderbird < 78.3

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 78.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-44 advisory. - When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting i...

EUVD-2022-4734

Malicious code in bioql PyPI...

CVE-2024-55492

Winmail Server 4.4 is vulnerable to fuser=%22%3E%3Csvg%20onload Cross Site Scripting XSS...

CVE-2023-2521

A vulnerability was found in NEXTU NEXT-7004N 3.0.1. It has been classified as problematic. Affected is an unknown function of the file /boafrm/formFilter of the component POST Request Handler. The manipulation of the argument url with the input leads to cross site scripting. It is possible to...

SUSE CVE-2020-15676

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox 81, Thunderbird 78.3, and Firefox ESR 78.3...